…ations (#2623)

The tight loop previously admitted only expression-statement bodies, so
the stopwatch-shaped body (var decl + 4-way else-if chain calling tiny
closures + two member-read var decls) paid full per-statement ceremony:
PrepareFor, Completion materialization, statement-list bookkeeping and
the nested if suspension probes, 391k times per benchmark op.

The body shape predicate now admits expression statements, var/let/const
declarations (using/await-using excluded) and if/else chains over such
statements, including declaration-free brace blocks. Control flow that
routes completions (break/continue/return/labels/loops/switch/try),
other declarations and AnnexB function-declaration branches still
disqualify structurally, so every admitted completion is Normal by
construction and the lane needs no completion routing.

Dispatch happens through a new virtual JintStatement.ExecuteDiscarded
(default: full Execute) with lean overrides for expression statements,
if statements (unboxed GetBooleanValue test, no suspension-range checks,
no UpdateEmpty), variable declarations (slot lane / cached-global route
already end in Empty completions) and declaration-free nested blocks.
Deferred errors keep the existing per-statement Engine._error poll
protocol; statements after a deferred error do not run.

Bodies with lexical declarations engage only when #2610 flattening is
active: the pooled loop env carries the body slots and the tight loop
re-establishes their TDZ per iteration exactly like the generic
flattened arm. Rider: JintConditionalExpression now takes the unboxed
GetBooleanValue path for its test in non-suspendable frames.


Claude-Session: https://claude.ai/code/session_01BY8HoKam5H8vTPn1bMY2Hv

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…#2709)

Loop-body lexical flattening (#2610) folds an eligible body block's let/const
bindings into the pooled loop environment. The eligibility gate (NamesOverlap)
only checked body names against the header's declared names, missing the case
where a body name shadows an outer binding a header expression references:

    for (let l = r; l < o; l++) { let r = e[l], o = t.get(r); ... }

The header's r/o resolve to outer bindings, but flattening folded the body's
r/o slots into the loop env, so the header read them while still uninitialized
-> "r has not been initialized". V8 runs it fine. This is the shape in
Turbopack's module-factory runtime, so it aborted Turbopack/Next.js renders.

Add HeaderReferencesAnyBodyName, declining to flatten when any body slot name
appears as an identifier in init/test/update. Over-approximates in the safe
direction, mirroring EnvironmentEscapeAstVisitor.ClosureReferencesAny. The scan
runs once at construction, so there is no per-iteration cost, and flattening
still applies to headers that reference no shadowed name.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>